Description
Description
X509Chain.Build() throws a CryptographicException
when building a chain that contains a user principal name (UPN) name constraint. This prevents the caller from getting any information about the validity of the chain.
This problem is due to openSSL not supporting UPN based name constraints and MapVerifyErrorToChainStatus
not mapping the status code that openSSL provides for this error (51).
This only seems affect systems that rely on OpenSSL.
- Windows supports UPN name constraints correctly.
- MacOS does not support UPN name constraints but skips the check.
Reproduction Steps
Add the following unit test to ./src/libraries/System.Security.Cryptography/tests/X509Certificates/DynamicChainTests.cs
[Fact]
[SkipOnPlatform(TestPlatforms.Windows, "Windows supports UPN name constraints.")]
[SkipOnPlatform(PlatformSupport.AppleCrypto, "macOS ignores UPN name constraints.")]
public static void UnknownNameConstraintViolation_UserPrincipalName()
{
SubjectAlternativeNameBuilder builder = new SubjectAlternativeNameBuilder();
builder.AddUserPrincipalName("johndoe@microsoft.com");
// exlude UPN name constraint for @microsoft.com
string nameConstraints = "3024A1223020A01E060A2B060104018237140203A0100C0E406D6963726F736F66742E636F6D";
TestNameConstrainedChain(nameConstraints, builder, (bool result, X509Chain chain) => {
Assert.False(result, "chain.Build");
Assert.Equal(PlatformNameConstraints(X509ChainStatusFlags.HasNotSupportedNameConstraint), chain.AllStatusFlags());
});
}
Expected behavior
X509Chain.Build()
does not throw an exception but adds a chain status flag to the chain. (ex: X509ChainStatusFlags.HasNotSupportedNameConstraint
or similar)
Actual behavior
X509Chain.Build()
throws a CryptographicException
Regression?
No response
Known Workarounds
No response
Configuration
No response
Other information
No response